ImmediateInterpreter: Fix use of touch_cnt as a finger count
In rare cases, HardwareState::touch_cnt may include fingers that aren't
actually tracked by the pad and thus may not be included in the
HardwareState::fingers array. Using it as the length for that array
could result in memory access issues.
BUG=None
TEST=unit tests
Change-Id: Ibb76063dbad7a58e14d3fc4729452a760ad04106
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/gestures/+/4574665
Code-Coverage: Torsha Banerjee <torsha@google.com>
Tested-by: Harry Cutts <hcutts@chromium.org>
Reviewed-by: Sean O'Brien <seobrien@chromium.org>
Commit-Queue: Harry Cutts <hcutts@chromium.org>
diff --git a/src/immediate_interpreter.cc b/src/immediate_interpreter.cc
index 6f69156..58f97f8 100644
--- a/src/immediate_interpreter.cc
+++ b/src/immediate_interpreter.cc
@@ -723,7 +723,7 @@
// Copy all fingers to an array, but leave out palms
num_fingers_ = 0;
- for (int i = 0; i < hwstate.touch_cnt; ++i) {
+ for (int i = 0; i < hwstate.finger_cnt; ++i) {
const FingerState& fs = hwstate.fingers[i];
if (fs.flags & (GESTURES_FINGER_PALM | GESTURES_FINGER_POSSIBLE_PALM))
continue;
